Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between the customer (“Controller”, “you”) and Uplink Sites (“Processor”, “we”, “us”), and forms part of the Terms of Service (/analytics/terms). It governs our processing of personal data about your website visitors that we carry out on your behalf through the Uplink Analytics service (the “Service”).

This DPA is drafted to satisfy Article 28 of the UK GDPR and the EU GDPR. By accepting the Terms of Service you accept this DPA. No signature is required, though we will execute a countersigned copy on request.

For Australian customers, this DPA is provided as a contractual statement of the data-handling practices we apply consistent with the Australian Privacy Principles (APPs 6, 8, and 11). It is not a separate statutory instrument under the Privacy Act 1988 (Cth) but operates alongside our general obligations under that Act.

Terms used but not defined here (“personal data”, “processing”, “controller”, “processor”, “data subject”, “sub-processor”, “supervisory authority”) have the meanings given in the UK GDPR and the EU GDPR as applicable.

“Visitor Data” means personal data relating to visitors of your websites that we process on your behalf through the Service.

• Subject-matter: our provision of the Service to you.
• Duration: for the term of your subscription and thereafter as described in section 10.
• Nature and purpose: collection, organisation, storage, analysis, and presentation of aggregate visitor analytics for your websites.
• Type of personal data: URLs visited, referrers, derived browser/OS/device/country, and any custom-event data you configure — processed on an aggregate, non-identifying basis.
• Categories of data subjects: visitors to your websites.
• Roles: you are the Controller; we are the Processor.

We will:

• process Visitor Data only on your documented instructions, including as set out in the Terms and this DPA, unless required to process otherwise by law (in which case we will notify you unless the law prohibits it);
• ensure that personnel authorised to process Visitor Data are under a duty of confidentiality;
• implement appropriate technical and organisational measures to protect Visitor Data (see section 6);
• assist you, taking into account the nature of the processing, to respond to requests from data subjects and to comply with your obligations under Articles 32–36 of the GDPR (security, breach notification, impact assessments, prior consultation);
• on termination, delete or return Visitor Data in accordance with section 10;
• make available to you information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits in accordance with section 8.

You:

• are solely responsible for the legality of the Visitor Data you direct us to process;
• will provide all notices and obtain all consents from your visitors as required by applicable law, including under the UK GDPR, EU GDPR, ePrivacy rules, and CCPA/CPRA;
• will not instruct us to process Visitor Data in a manner that breaches applicable law, and will not upload to the Service any special-category personal data or personal data of a kind prohibited by the Terms;
• will comply with the acceptable-use and no-personal-data provisions in the Terms.

You give us general authorisation to engage sub-processors to help deliver the Service. Our current sub-processors are listed in section 7 of the Privacy Policy.

We will give you at least 30 days' prior notice of any intended change (addition or replacement) by updating the sub-processor list and, for paid-tier customers, by email. You may object to a proposed change on reasonable data-protection grounds by writing to privacy@uplinksites.net before the change takes effect. If we cannot accommodate your objection you may terminate the affected part of the Service.

We will impose on each sub-processor contractual terms that are at least as protective as those in this DPA, and we remain fully liable to you for the performance of those sub-processors.

We implement and maintain appropriate technical and organisational measures designed to protect Visitor Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, including:

• TLS 1.2+ for all data in transit, and at-rest encryption of database backups;
• role-based access controls and multi-factor authentication for production access;
• network-level hardening (firewall, fail2ban, restricted SSH) on production hosts;
• regular patching and dependency review;
• daily backups, retained for 30 days;
• logical separation of customer data within shared infrastructure;
• deletion or pseudonymisation of IP addresses immediately after country/region derivation — we do not retain IPs.

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Visitor Data. The notification will include, to the extent known: the nature of the breach, the categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address it.

We make available to you the information needed to demonstrate compliance with Article 28 of the GDPR. On your reasonable written request, no more than once per twelve-month period (except where required by a supervisory authority or following a personal data breach), we will respond to a written security questionnaire. On-site audits are not permitted by default; if required by law or a supervisory authority, we will work with you in good faith to agree reasonable scope, timing, and cost.

Where Visitor Data is transferred outside the UK or the EEA, we rely on the UK International Data Transfer Addendum and/or the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller-to-processor), as the transfer mechanism. The SCCs/IDTA are incorporated into this DPA by reference, with the following module selections: no optional docking clause; Option 2 for notification of sub-processor changes; governing law and supervisory forum as set out in the Terms.

On termination of the Service and at your choice, we will delete or return all Visitor Data within 90 days, and delete existing copies unless we are required by law to retain them. You may export aggregate reports before termination using the Service's export functionality.

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA excludes or limits liability that cannot lawfully be excluded or limited under applicable data-protection law.

In the event of a conflict between this DPA and the Terms of Service, this DPA prevails with respect to the processing of Visitor Data. In the event of a conflict between this DPA and the SCCs/IDTA, the SCCs/IDTA prevail.

Questions about this DPA, or requests for a countersigned copy, should be sent to privacy@uplinksites.net.